APILensDocs 1.0.0

APILens

Drop-in live traffic dashboard and a fully custom API documentation UI for ASP.NET Web API 2 (OWIN) applications. No external services, no Node/build tooling - the docs/dashboard UI is plain HTML/CSS/JS.

What you get

• Live traffic dashboard - total hits/success/fail, an hourly bar chart, and a per-endpoint breakdown, all computed in-memory from real requests.
• Per-endpoint drill-down - hourly chart and a log of the most recent individual requests for one endpoint.
• Request/response payload viewer - click a recent request to see its actual request and response body in a popup, with common sensitive field names (passwords, tokens, card numbers, etc.) automatically redacted before anything is stored.
• Custom documentation UI - reads your existing Swagger/OpenAPI 2.0 JSON (e.g. from Swashbuckle) and renders a fully brandable Overview / Endpoints / Schemas experience with a working "Try it out" (editable headers, live cURL preview, tabbed response viewer).

Everything is in-memory and resets when the app pool recycles - this is a live/rolling view, not a persisted audit log.

Install

1. Install this package into your ASP.NET Web API 2 project.

2. In your WebApiConfig (or wherever you configure HttpConfiguration), add:

   config.EnableApiLens();
   

   Or override the defaults:

   config.EnableApiLens(options =>
   {
       options.RetainHours = 72;
       options.MaxRecentRequestsPerEndpoint = 100;
       options.SensitiveFieldNames.Add("accountNumber");
   });
   

3. Copy the content/ApiLensDocs folder (installed alongside this package) into your web project as static content, then browse to /ApiLensDocs/index.html.

4. If your Swagger JSON isn't served at the default /swagger/docs/v1, edit apilens.config.js (in the copied folder) to point at the right URL.

Security note

This package does not add authentication to the dashboard or diagnostics endpoints (/api/_apilens/stats, /api/_apilens/stats/endpoint) - it tracks whatever your app already allows. If your API is not otherwise locked down, anyone who can reach those routes can see captured traffic, including request bodies (minus redacted fields). Restrict access to these routes the same way you would any other sensitive endpoint in your app (e.g. an [Authorize] filter, IP allowlist, or a reverse-proxy rule) if that matters for your deployment.

Configuration reference (ApiLensOptions)

Powered by Irosh Fernando.